ID CVE-2009-1904
Summary The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
References
Vulnerable Configurations
  • cpe:2.3:a:ruby-lang:ruby:1.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.7:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 29-09-2017 - 01:34)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
oval via4
accepted 2013-04-29T04:22:07.774-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
family unix
id oval:org.mitre.oval:def:9780
status accepted
submitted 2010-07-09T03:56:16-04:00
title The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
version 24
redhat via4
advisories
bugzilla
id 504958
title CVE-2009-1904 ruby: DoS vulnerability in BigDecimal
oval
OR
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304001
    • OR
      • AND
        • comment irb is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140012
        • comment irb is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729015
      • AND
        • comment ruby is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140002
        • comment ruby is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729003
      • AND
        • comment ruby-devel is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140008
        • comment ruby-devel is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729011
      • AND
        • comment ruby-docs is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140006
        • comment ruby-docs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729007
      • AND
        • comment ruby-libs is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140010
        • comment ruby-libs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729009
      • AND
        • comment ruby-mode is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140004
        • comment ruby-mode is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729005
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3
          oval oval:com.redhat.rhsa:tst:20091140014
        • comment ruby-tcltk is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060729013
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment ruby is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140017
        • comment ruby is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965003
      • AND
        • comment ruby-devel is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140031
        • comment ruby-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965013
      • AND
        • comment ruby-docs is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140019
        • comment ruby-docs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965017
      • AND
        • comment ruby-irb is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140021
        • comment ruby-irb is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965011
      • AND
        • comment ruby-libs is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140027
        • comment ruby-libs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965019
      • AND
        • comment ruby-mode is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140025
        • comment ruby-mode is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965005
      • AND
        • comment ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140029
        • comment ruby-rdoc is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965007
      • AND
        • comment ruby-ri is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140023
        • comment ruby-ri is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965015
      • AND
        • comment ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7
          oval oval:com.redhat.rhsa:tst:20091140033
        • comment ruby-tcltk is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070965009
rhsa
id RHSA-2009:1140
released 2009-07-02
severity Moderate
title RHSA-2009:1140: ruby security update (Moderate)
rpms
  • irb-0:1.8.1-7.el4_8.3
  • ruby-0:1.8.1-7.el4_8.3
  • ruby-devel-0:1.8.1-7.el4_8.3
  • ruby-docs-0:1.8.1-7.el4_8.3
  • ruby-libs-0:1.8.1-7.el4_8.3
  • ruby-mode-0:1.8.1-7.el4_8.3
  • ruby-tcltk-0:1.8.1-7.el4_8.3
  • ruby-0:1.8.5-5.el5_3.7
  • ruby-devel-0:1.8.5-5.el5_3.7
  • ruby-docs-0:1.8.5-5.el5_3.7
  • ruby-irb-0:1.8.5-5.el5_3.7
  • ruby-libs-0:1.8.5-5.el5_3.7
  • ruby-mode-0:1.8.5-5.el5_3.7
  • ruby-rdoc-0:1.8.5-5.el5_3.7
  • ruby-ri-0:1.8.5-5.el5_3.7
  • ruby-tcltk-0:1.8.5-5.el5_3.7
refmap via4
apple APPLE-SA-2010-03-29-1
bid 35278
confirm
fedora FEDORA-2009-13066
gentoo GLSA-200906-02
mandriva MDVSA-2009:160
mlist
  • [pkgsrc-changes] 20090610 CVS commit: pkgsrc/lang/ruby18-base
  • [rubyonrails-security] 20090610 DoS Vulnerability in Ruby (CVE-2009-1904)
osvdb 55031
sectrack 1022371
secunia
  • 35399
  • 35527
  • 35593
  • 35699
  • 35937
  • 37705
slackware SSA:2009-170-02
ubuntu USN-805-1
vupen ADV-2009-1563
xf ruby-bigdecimal-dos(51032)
Last major update 29-09-2017 - 01:34
Published 11-06-2009 - 21:30
Back to Top